Switch from HTTP basic auth to MCIAS

Replace HTTP basic auth with MCIAS session cookies. Adds mcdsl auth,
csrf, and web packages. Chi router for route-level auth middleware.
Short code redirects (GET /{short}) remain public; all management
pages require MCIAS login. Nord dark theme, layout+page template
pattern matching other platform services.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

templates/index.html

@@ -0,0 +1,27 @@
+{{define "title"}} — Shorten{{end}}
+{{define "content"}}
+<h2>Shorten a URL</h2>
+{{if (ne .Short "")}}
+<div class="success">
+    Short code: <a href="/{{.Short}}">{{.Short}}</a>
+</div>
+{{end}}
+<div class="card">
+    <form method="POST" action="/">
+        {{csrfField}}
+        <div class="form-group">
+            <label for="value">URL</label>
+            <input type="text" id="value" name="value" placeholder="https://..." required>
+        </div>
+        <div class="form-group">
+            <label>
+                <input type="checkbox" name="strip"> Strip query string
+            </label>
+        </div>
+        <div class="form-actions">
+            <button type="submit" class="btn">Shorten</button>
+            <a href="/list" class="btn-ghost btn">View all</a>
+        </div>
+    </form>
+</div>
+{{end}}